memoryplusprogram.com
Open in
urlscan Pro
69.16.236.216
Public Scan
Effective URL: http://memoryplusprogram.com/get.php?aff_id=2843&subid=OCTOBER_1MEMORY2020
Submission: On October 01 via api from DE
Summary
This is the only time memoryplusprogram.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
ASN13335 (CLOUDFLARENET, US)
www.lightweightkslossprotocol.us |
ASN20446 (HIGHWINDS3, US)
maxcdn.bootstrapcdn.com | |
stackpath.bootstrapcdn.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN36351 (SOFTLAYER, US)
PTR: 85.82.1732.ip4.static.sl-reverse.com
echo.spapi.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN36351 (SOFTLAYER, US)
PTR: ed.b7.c0ad.ip4.static.sl-reverse.com
tracking.buygoods.com |
ASN36351 (SOFTLAYER, US)
PTR: buygoods.com
www.buygoods.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
memoryplusprogram.com
memoryplusprogram.com |
847 KB |
3 |
gstatic.com
fonts.gstatic.com |
40 KB |
2 |
facebook.com
www.facebook.com |
405 B |
2 |
buygoods.com
tracking.buygoods.com www.buygoods.com |
15 KB |
2 |
youtube.com
www.youtube.com |
1 KB |
2 |
facebook.net
connect.facebook.net |
93 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com stackpath.bootstrapcdn.com |
34 KB |
2 |
lightweightkslossprotocol.us
2 redirects
www.lightweightkslossprotocol.us |
2 KB |
1 |
ytimg.com
s.ytimg.com |
36 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
spapi.com
echo.spapi.com |
1 KB |
1 |
onesignal.com
cdn.onesignal.com |
3 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
36 KB |
1 |
googleapis.com
fonts.googleapis.com |
895 B |
28 | 16 |
Domain | Requested by | |
---|---|---|
6 | memoryplusprogram.com |
memoryplusprogram.com
|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | www.facebook.com |
memoryplusprogram.com
|
2 | www.youtube.com |
memoryplusprogram.com
s.ytimg.com |
2 | connect.facebook.net |
memoryplusprogram.com
connect.facebook.net |
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | www.lightweightkslossprotocol.us | 2 redirects |
1 | s.ytimg.com |
www.youtube.com
|
1 | www.buygoods.com |
memoryplusprogram.com
|
1 | tracking.buygoods.com |
memoryplusprogram.com
|
1 | stackpath.bootstrapcdn.com |
memoryplusprogram.com
|
1 | cdnjs.cloudflare.com |
memoryplusprogram.com
|
1 | code.jquery.com |
memoryplusprogram.com
|
1 | echo.spapi.com |
memoryplusprogram.com
|
1 | cdn.onesignal.com |
memoryplusprogram.com
|
1 | www.googletagmanager.com |
memoryplusprogram.com
|
1 | fonts.googleapis.com |
memoryplusprogram.com
|
1 | maxcdn.bootstrapcdn.com |
memoryplusprogram.com
|
28 | 18 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.buygoods.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-04 - 2021-08-04 |
a year | crt.sh |
*.spapi.com Go Daddy Secure Certificate Authority - G2 |
2019-07-15 - 2021-07-15 |
2 years | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
cdnjs.cloudflare.com DigiCert ECC Secure Server CA |
2020-08-12 - 2022-08-17 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2020-09-11 - 2020-12-10 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
clickcrm.com DigiCert SHA2 Secure Server CA |
2020-08-25 - 2021-11-03 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://memoryplusprogram.com/get.php?aff_id=2843&subid=OCTOBER_1MEMORY2020
Frame ID: 45D713F5DF3FF3CB9715463EB4117D35
Requests: 27 HTTP requests in this frame
Frame:
https://www.youtube.com/embed/zdflGQtWB2Y?autoplay=0&controls=0&rel=0&modestbranding=1&showinfo=0&wmode=transparent&enablejsapi=1&origin=http%3A%2F%2Fmemoryplusprogram.com&widgetid=1
Frame ID: 65A6D0E0079E3CB1EFAA054A3BFB2326
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.lightweightkslossprotocol.us/?ejakfhcigdbk=dWhvT0FuUkhQRGNnK2lwMlJ4ckx1eWppK2ZBeTdZOG5aakRSbVlheDhEYXFld0...
HTTP 302
http://www.lightweightkslossprotocol.us/click.php?tt=manu&mm=621603&ll=Opener%2020/8/18&cc=6874&ss=10836&sid=33241&f... HTTP 302
http://memoryplusprogram.com/get.php?aff_id=2843&subid=OCTOBER_1MEMORY2020 Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.lightweightkslossprotocol.us/?ejakfhcigdbk=dWhvT0FuUkhQRGNnK2lwMlJ4ckx1eWppK2ZBeTdZOG5aakRSbVlheDhEYXFld05ORFByVmZUM2I1LzlOelVWUXk5Z0dqK0hDaFpCT2ZJZ3pSMDJ6bGxKbjZqNDZCWVFvTkZZM01wNlUrSWtNSXFyQWFjN0JPWFQ5b0hNYm4rcjQ4bUl0YWc2My9XOUhUU3VhR043M0hjRlFYT09vRFhwczVOYysxYWp1ZGtZTW5Cc0IwMkhlZkJZc2x1OTZraW1qZUI3amtJYnVvaDhMVHhldldkejh6Y3V4eVhSRkpSL1FxK2NDaUxEUW91az0=
HTTP 302
http://www.lightweightkslossprotocol.us/click.php?tt=manu&mm=621603&ll=Opener%2020/8/18&cc=6874&ss=10836&sid=33241&fid=22867&rr=click&offer=0&origclickurl=memoryplusprogram.com/get.php?aff_id=2843-*-subid=OCTOBER_1MEMORY2020 HTTP 302
http://memoryplusprogram.com/get.php?aff_id=2843&subid=OCTOBER_1MEMORY2020 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
get.php
memoryplusprogram.com/ Redirect Chain
|
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
8 KB 895 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video.css
memoryplusprogram.com/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
90 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalSDK.js
cdn.onesignal.com/sdks/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
button-2.png
memoryplusprogram.com/img/ |
49 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
disclaimer
echo.spapi.com/v1/ |
1 KB 1 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
45 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
88 KB 23 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
body-bg.jpg
memoryplusprogram.com/img/ |
92 KB 92 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-down-vsl.png
memoryplusprogram.com/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tap-cover.jpg
memoryplusprogram.com/img/ |
697 KB 697 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v15/ |
13 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iframe_api
www.youtube.com/ |
859 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
tracking.buygoods.com/track/ |
4 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buygoods_black.png
www.buygoods.com/images/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
1 B 68 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2012392055737333
connect.facebook.net/signals/config/ |
234 KB 69 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vflBWZFZo/ |
102 KB 36 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
zdflGQtWB2Y
www.youtube.com/embed/ Frame 65A6 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
44 B 259 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
44 B 146 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
69 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| google_tag_manager object| dataLayer function| gtag object| google_tag_data string| GoogleAnalyticsObject function| ga function| fbq function| _fbq object| OneSignal function| $ function| jQuery function| Popper object| bootstrap object| tag object| firstScriptTag object| player boolean| youtube boolean| videoStarted function| onYouTubePlayerAPIReady function| onPlayerReady boolean| done function| onPlayerStateChange function| handleNewViewer function| handleReturningViewer function| createCookie function| getCookie function| stopVideo string| mysrc object| newScript object| s function| ReadCookie object| gaplugins object| gaGlobal object| gaData object| YT object| YTConfig function| onYTReady object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportLogPayloadsQueue_ object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| spitoday object| spiexpire function| SPIGetDomainName string| hostname object| spi_myNodelist number| spi_i string| spi_pattern_enc_bg string| spi_pattern_base_bg string| spi_replace_str_bg string| spi_pattern_enc_spi string| spi_pattern_base_spi string| spi_replace_str_spi string| spi_pattern_enc_cbd string| spi_pattern_base_cbd string| spi_replace_str_cbd string| spi_replace_enc_cbd string| spi_replace_enc_bg string| spi_replace_enc_spi string| spi_track_link12 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.youtube.com/ | Name: VISITOR_INFO1_LIVE Value: ShCXUW3Koq8 |
|
.youtube.com/ | Name: YSC Value: 6QVokJ_wUf0 |
|
.memoryplusprogram.com/ | Name: sid Value: OCTOBER_1MEMORY2020 |
|
.memoryplusprogram.com/ | Name: _gid Value: GA1.2.823289974.1601567821 |
|
.memoryplusprogram.com/ | Name: aff_id Value: 2843 |
|
.memoryplusprogram.com/ | Name: campaign_id Value: |
|
.memoryplusprogram.com/ | Name: _fbp Value: fb.1.1601567821598.864287318 |
|
.memoryplusprogram.com/ | Name: _gat_gtag_UA_138713396_27 Value: 1 |
|
.memoryplusprogram.com/ | Name: sessid2 Value: sessid2020100115573357 |
|
.memoryplusprogram.com/ | Name: referrer Value: 82.102.19.136::memoryplusprogram.com%2Fget |
|
.memoryplusprogram.com/ | Name: spi_funnel_codename Value: |
|
.memoryplusprogram.com/ | Name: _ga Value: GA1.2.1944421417.1601567821 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.onesignal.com
cdnjs.cloudflare.com
code.jquery.com
connect.facebook.net
echo.spapi.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
memoryplusprogram.com
s.ytimg.com
stackpath.bootstrapcdn.com
tracking.buygoods.com
www.buygoods.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.lightweightkslossprotocol.us
www.youtube.com
173.192.183.235
173.192.183.237
2001:4de0:ac19::1:b:2b
2001:4de0:ac19::1:b:3a
2606:4700:3030::ac43:dbe6
2606:4700::6811:4f6b
2606:4700::6812:e134
2a00:1450:4001:800::200e
2a00:1450:4001:801::200e
2a00:1450:4001:802::200a
2a00:1450:4001:81a::2008
2a00:1450:4001:81d::200e
2a00:1450:4001:821::200e
2a00:1450:4001:825::2003
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
50.23.130.133
69.16.236.216
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1848757fe76cdf609a4dc9f87fa1b73db321f26efed84673bd4abe75e9bb5c66
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
2cb03a6ad52f3297e5aca7ecd373edbb7a35a1058bf6a44b1f4fcced217c8c5f
364bfcbd2c2eb80bea8d7bc435e7791de681966bb075baead08288599ff02620
3e7b395639edfab2d1116e18b1e0512a3dc96e3eac86d45fae7d800790cbe62b
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
731175f16f8ff9c9ddba3a0e2cb13c0113270f34877517c618724f503a4f22f0
735f1c73f436f4c32eaf0e2ccff60e7a0e78d9edb466b08bd2e9e6ca9044d2af
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
941d6a69ad948de5b9388c664ffc1ac0c97361d67d079716c57edc82a7fcecfb
ad7af91e6d53f8e0f395ea409c498904de298114fbef71d8c7ee8948c855ae44
b6539495b72053bc8c7fb5270adb8d1faeb20302842f7ec4a56d879b281344d9
bf37bddc8c671dde76f85b30f9c7ff189d35282d716b0dac72976adc9294aab6
c5f0e8e6c915a6b700d7c19ddc7abd1c595b1f1f8e211284b71526d021422967
c94e10349813e4edc003eb3012795c59f4e2a4cf9c918f0868b050f0829ed660
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
df41e5916a5f0b5fa0f1a0e1ddf67ff073cf3738e0bb356fb9e6b3a31b9e5ab8
f4bd7cd6eb2928987869d4af66ba71de49a9052a3cddd03aae6a7075f7782b20
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
ff275d0907ee3185c117355cad64b0ded33ff9b98422ba6877fc50e7c1f7bb52
ffb110318b55e8d7acaeaa7816d495e33a5000643327241099565537973ed051